<![CDATA[KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens]]>

<![CDATA[KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens]]>Cybersecurity researchers at Elastic Security Labs have detailed a previously undocumented Brazilian banking malware operation tracked as REF9334. Active since at least May 2025, the campaign delivers a toolkit named KREMLIN and relies on lures that impersonate roughly a dozen Brazilian banks to trick victims into installing a malicious browser extension on Google Chrome and Microsoft Edge.

The extension is the core of the attack. Once in place, it hijacks the browsers to steal credentials and session tokens, allowing the operators to bypass authentication without needing to crack passwords directly. By abusing active sessions, the malware can reach banking portals while the victim is still logged in, which makes traditional credential-based defenses far less effective.

Key facts at a glance:

Tooling: KREMLIN toolkit, delivered via a malicious browser extension
Threat actor: tracked as REF9334 by Elastic Security Labs
Active since: at least May 2025
Targeted browsers: Google Chrome and Microsoft Edge
Lures: fake pages impersonating around a dozen Brazilian banks
Impact: theft of credentials and session tokens

Because the campaign depends on user interaction with convincing bank-themed lures, awareness and browser hardening remain the first lines of defense. Organizations and individuals in Brazil should treat unexpected extension install prompts with suspicion and review what is actually running in their browsers.

Source: The Hacker News

Has anyone in the community observed similar bank-impersonation lures or unexpected browser extensions in their environment?

]]>https://xploitlk.com/topic/351/kremlin-banking-malware-hijacks-chrome-and-edge-to-steal-credentials-and-session-tokensRSS for NodeTue, 27 Oct 2026 08:52:11 GMTWed, 16 Sep 2026 02:30:17 GMT60